#!/bin/bash
################################################
##以下在controller1节点执行

#Keystone 配置
cp /etc/keystone/keystone.conf{,.bak}  #备份默认配置
Keys=$(openssl rand -hex 10)  #生成随机密码
echo $Keys
echo "kestone  $Keys">/root/openstack.log
echo "
[DEFAULT]
admin_token = $Keys
verbose = true
[database]
connection = mysql+pymysql://keystone:keystone@controller/keystone
[memcache]
servers = controller1:11211,controller2:11211,controller3:11211
[token]
provider = fernet
driver = memcache
# expiration = 86400
# caching = true
# cache_time = 86400
[cache]
enabled = true
backend = oslo_cache.memcache_pool
memcache_servers = controller1:11211,controller2:11211,controller3:11211
">/etc/keystone/keystone.conf

#初始化keystone数据库 
su -s /bin/sh -c "keystone-manage db_sync" keystone
#检查表是否创建成功
mysql -h controller -ukeystone -pkeystone -e "use keystone;show tables;"

#初始化Fernet密匙
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

#同步配置到其它节点(用scp会改变属性)

rsync -avzP -e 'ssh -p 22' /etc/keystone/* controller2:/etc/keystone/
rsync -avzP -e 'ssh -p 22' /etc/keystone/* controller3:/etc/keystone/


#重启http
systemctl restart httpd.service
ssh controller2 "systemctl restart httpd.service"
ssh controller3 "systemctl restart httpd.service"
# #检测服务否正常
# curl http://controller3:35356/v3 #查看单个节点
# curl http://controller:35357/v3 #查看群集代理



#设置admin用户（管理用户）和密码,服务实体和API端点
keystone-manage bootstrap --bootstrap-password admin \
 --bootstrap-admin-url http://controller:35357/v3/ \
 --bootstrap-internal-url http://controller:5000/v3/ \
 --bootstrap-public-url http://controller:5000/v3/ \
 --bootstrap-region-id RegionOne


#创建 OpenStack 客户端环境脚本


#admin环境脚本
echo "
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default 
export OS_PROJECT_NAME=admin 
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
">~/admin-openstack.sh
#测试脚本是否生效
source ~/admin-openstack.sh
openstack token issue


#创建service项目,创建glance,nova,neutron用户，并授权
openstack project create --domain default --description "Service Project" service
openstack user create --domain default --password=glance glance
openstack role add --project service --user glance admin
openstack user create --domain default --password=nova nova
openstack role add --project service --user nova admin
openstack user create --domain default --password=neutron neutron
openstack role add --project service --user neutron admin


#创建demo项目(普通用户密码及角色)
openstack project create --domain default --description "Demo Project" demo
openstack user create --domain default --password=demo demo
openstack role create user
openstack role add --project demo --user demo user


#demo环境脚本
echo "
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
">~/demo-openstack.sh
#测试脚本是否生效
source ~/demo-openstack.sh
openstack token issue